Please address the comments from this code review:

## Overall Comments
- Consider making the default SSH user in _batchImportServers configurable instead of hardcoding 'root', so it can adapt to environments where a different user is expected.
- Add explicit handling or a no-op path for unsupported platforms (e.g. Windows) in SshDiscoveryService so discovery failures aren’t silent on non-Linux/macOS hosts.
- Unify your localization references (libL10n vs. l10n) in the discovery UI to keep string lookups consistent and avoid confusion.

## Individual Comments

### Comment 1
<location> `lib/core/service/ssh_discovery.dart:32-33` </location>
<code_context>
+    }
+
+    // Filter out unwanted addresses
+    candidates.removeWhere((a) => a.isLoopback || a.isLinkLocal || a.address == '0.0.0.0');
+
+    // 4) Concurrent SSH port scanning
</code_context>

<issue_to_address>
**suggestion:** Consider filtering out broadcast and multicast addresses.

Broadcast and multicast addresses are not currently excluded, which could result in unnecessary scans and false positives.

```suggestion
    // Filter out unwanted addresses: loopback, link-local, 0.0.0.0, broadcast, multicast
    bool _isBroadcastOrMulticast(a) {
      // IPv4 broadcast: ends with .255 or is 255.255.255.255
      if (a.type == InternetAddressType.IPv4) {
        if (a.address == '255.255.255.255') return true;
        if (a.address.split('.').last == '255') return true;
        // Multicast: 224.0.0.0 - 239.255.255.255
        final firstOctet = int.tryParse(a.address.split('.').first) ?? 0;
        if (firstOctet >= 224 && firstOctet <= 239) return true;
      } else if (a.type == InternetAddressType.IPv6) {
        // IPv6 multicast: starts with ff
        if (a.address.toLowerCase().startsWith('ff')) return true;
      }
      return false;
    }

    candidates.removeWhere((a) =>
      a.isLoopback ||
      a.isLinkLocal ||
      a.address == '0.0.0.0' ||
      _isBroadcastOrMulticast(a)
    );
```
</issue_to_address>

### Comment 2
<location> `lib/core/service/ssh_discovery.dart:21-23` </location>
<code_context>
+
+    // 2) Enumerate small subnets from local interfaces (IPv4 only)
+    final cidrs = await _localIPv4Cidrs();
+    for (final c in cidrs) {
+      if (c.prefix >= 24 && c.prefix <= 30) {
+        candidates.addAll(c.enumerateHosts(limit: 4096));
+      }
+    }
</code_context>

<issue_to_address>
**suggestion:** Host enumeration limit is hardcoded to 4096.

Consider exposing the host enumeration limit as a parameter in SshDiscoveryConfig so users can adjust it based on their needs.

Suggested implementation:

```
  static Future<SshDiscoveryReport> discover([SshDiscoveryConfig config = const SshDiscoveryConfig()]) async {
    final t0 = DateTime.now();
    final candidates = <InternetAddress>{};

    // 1) Get neighbors from ARP/NDP tables
    candidates.addAll(await _neighborsIPv4());
    candidates.addAll(await _neighborsIPv6());

    // 2) Enumerate small subnets from local interfaces (IPv4 only)
    final cidrs = await _localIPv4Cidrs();
    for (final c in cidrs) {
      if (c.prefix >= 24 && c.prefix <= 30) {
        candidates.addAll(c.enumerateHosts(limit: config.hostEnumerationLimit));
      }
    }

    // 3) Optional: mDNS/Bonjour SSH services
    if (config.enableMdns) {
      candidates.addAll(await _mdnsSshCandidates());
    }

    // Filter out unwanted addresses
    candidates.removeWhere((a) => a.isLoopback || a.isLinkLocal || a.address == '0.0.0.0');

```

You will also need to update the `SshDiscoveryConfig` class to add a `hostEnumerationLimit` field, with a default value of 4096, and ensure it is included in the constructor and `const` declaration. For example:

```dart
class SshDiscoveryConfig {
  final bool enableMdns;
  final int hostEnumerationLimit;

  const SshDiscoveryConfig({
    this.enableMdns = false,
    this.hostEnumerationLimit = 4096,
  });
}
```
</issue_to_address>

### Comment 3
<location> `lib/core/service/ssh_discovery.dart:98-106` </location>
<code_context>
+        }
+      }
+    } else if (_isMac) {
+      final s = await _run('/usr/sbin/arp', ['-an']);
+      if (s != null) {
+        for (final line in const LineSplitter().convert(s)) {
+          final m = RegExp(r'\((\d+\.\d+\.\d+\.\d+)\)').firstMatch(line);
+          if (m != null) {
+            set.add(InternetAddress(m.group(1)!));
+          }
+        }
+      }
+    }
+    return set;
+  }
+
</code_context>

<issue_to_address>
**suggestion (bug_risk):** ARP/NDP parsing may fail silently on unexpected output.

If ARP/NDP output format changes or is localized, parsing may fail and return an empty set without warning. Recommend adding error logging to aid troubleshooting.

```suggestion
      final s = await _run('/usr/sbin/arp', ['-an']);
      if (s != null) {
        int matchCount = 0;
        for (final line in const LineSplitter().convert(s)) {
          final m = RegExp(r'\((\d+\.\d+\.\d+\.\d+)\)').firstMatch(line);
          if (m != null) {
            set.add(InternetAddress(m.group(1)!));
            matchCount++;
          }
        }
        if (matchCount == 0) {
          print('[ssh_discovery] Warning: No ARP entries parsed on macOS. Output may be unexpected or localized. Output sample: $s');
        }
      }
```
</issue_to_address>

### Comment 4
<location> `lib/core/service/ssh_discovery.dart:155-164` </location>
<code_context>
+      final s = await _run('/sbin/ifconfig', []);
</code_context>

<issue_to_address>
**suggestion:** Parsing ifconfig output may be brittle across OS versions.

Regular expressions may not handle all variations or localized outputs. Consider a more robust parsing approach or add error handling for unexpected formats.

Suggested implementation:

```
      final s = await _run('/sbin/ifconfig', []);
      if (s != null) {
        for (final raw in const LineSplitter().convert(s)) {
          final line = raw.trimRight();
          final ifMatch = RegExp(r'^([a-z0-9]+):').firstMatch(line);
          if (ifMatch != null) {
            continue;
          }
          if (line.contains('inet ') && !line.contains('127.0.0.1')) {
            try {
              final ipm = RegExp(
                r'inet\s+(\d+\.\d+\.\d+\.\d+)\s+netmask\s+0x([0-9a-fA-F]+)(?:\s+broadcast\s+(\d+\.\d+\.\d+\.\d+))?',
              ).firstMatch(line);
              if (ipm == null) {
                // Log or handle unexpected format
                print('Warning: Unexpected ifconfig line format: $line');
                continue;
              }
              // Existing parsing logic here...
              // Example:
              // final ip = InternetAddress(ipm.group(1)!);
              // final netmaskHex = ipm.group(2)!;
              // final netmask = _hexNetmaskToPrefix(netmaskHex);
              // final broadcast = ipm.group(3);
              // res.add(_Cidr(ip, netmask, ...));
            } catch (e) {
              print('Error parsing ifconfig output: $e, line: $line');
              continue;
            }
          }

```

- You may want to implement `_hexNetmaskToPrefix` or similar logic if not already present.
- Consider replacing `print` with your project's logging mechanism if available.
- If you want to further improve robustness, consider moving the parsing logic into a dedicated helper function.
</issue_to_address>

### Comment 5
<location> `lib/core/service/ssh_discovery.dart:282-291` </location>
<code_context>
+
+  Future<_ScanResult?> _probeSsh(InternetAddress ip) async {
+    try {
+      final socket = await Socket.connect(ip, SshDiscoveryService._sshPort, timeout: timeout);
+      socket.timeout(timeout);
+      final c = Completer<String?>();
+      late StreamSubscription sub;
+      sub = socket.listen(
+        (data) {
+          final s = utf8.decode(data, allowMalformed: true);
+          final line = s.split('\n').firstWhere((_) => true, orElse: () => s);
+          if (!c.isCompleted) {
+            c.complete(line.trim());
+            sub.cancel();
+          }
+        },
+        onDone: () {
+          if (!c.isCompleted) c.complete(null);
+        },
+        onError: (_) {
+          if (!c.isCompleted) c.complete(null);
+        },
+      );
+      final banner = await c.future.timeout(timeout, onTimeout: () => null);
+      socket.destroy();
+      return _ScanResult(ip, banner);
+    } catch (_) {
</code_context>

<issue_to_address>
**issue (bug_risk):** Socket may not be closed on all error paths.

Use a try/finally block to guarantee socket.destroy() is called even if an exception occurs.
</issue_to_address>

### Comment 6
<location> `lib/core/service/ssh_discovery.dart:286-295` </location>
<code_context>
+      socket.timeout(timeout);
+      final c = Completer<String?>();
+      late StreamSubscription sub;
+      sub = socket.listen(
+        (data) {
+          final s = utf8.decode(data, allowMalformed: true);
+          final line = s.split('\n').firstWhere((_) => true, orElse: () => s);
+          if (!c.isCompleted) {
+            c.complete(line.trim());
+            sub.cancel();
+          }
+        },
+        onDone: () {
+          if (!c.isCompleted) c.complete(null);
+        },
+        onError: (_) {
+          if (!c.isCompleted) c.complete(null);
+        },
+      );
+      final banner = await c.future.timeout(timeout, onTimeout: () => null);
+      socket.destroy();
+      return _ScanResult(ip, banner);
</code_context>

<issue_to_address>
**issue (bug_risk):** StreamSubscription may not be cancelled on all code paths.

sub.cancel() should be called after completion in all cases to prevent resource leaks.
</issue_to_address>

### Comment 7
<location> `lib/view/page/server/edit/actions.dart:28-34` </location>
<code_context>
+      );
+
+      if (shouldImport == true) {
+        final servers = discoveredServers.map((result) => Spi(
+          name: result.ip,
+          ip: result.ip,
+          port: result.port,
+          user: 'root', // Default username
+          keyId: _keyIdx.value?.toString(),
+          pwd: _passwordController.text.isEmpty ? null : _passwordController.text,
+        )).toList();
+
+        await _batchImportServers(servers);
+      }
+    }
</code_context>

<issue_to_address>
**suggestion:** Default username and keyId assignment may not suit all environments.

Consider prompting users to confirm or modify the default 'root' username and keyId before importing, or clearly indicate these defaults in the UI.

```suggestion
      // Prompt user to confirm or modify default username and keyId before importing
      String defaultUsername = 'root';
      String defaultKeyId = _keyIdx.value?.toString() ?? '';
      final importData = await showDialog<Map<String, String>>(
        context: context,
        builder: (context) {
          final usernameController = TextEditingController(text: defaultUsername);
          final keyIdController = TextEditingController(text: defaultKeyId);
          return AlertDialog(
            title: Text(libL10n.import),
            content: Column(
              mainAxisSize: MainAxisSize.min,
              children: [
                Text('${libL10n.found} ${discoveredServers.length} ${l10n.servers}.'),
                SizedBox(height: 8),
                Text('Default username: "$defaultUsername", keyId: "$defaultKeyId". You may modify these before importing.'),
                SizedBox(height: 8),
                TextField(
                  controller: usernameController,
                  decoration: InputDecoration(labelText: 'Username'),
                ),
                TextField(
                  controller: keyIdController,
                  decoration: InputDecoration(labelText: 'Key ID'),
                ),
              ],
            ),
            actions: [
              TextButton(
                onPressed: () => Navigator.of(context).pop(null),
                child: Text(libL10n.cancel),
              ),
              TextButton(
                onPressed: () => Navigator.of(context).pop({
                  'username': usernameController.text,
                  'keyId': keyIdController.text,
                }),
                child: Text(libL10n.ok),
              ),
            ],
          );
        },
      );

      if (importData != null) {
        final username = importData['username'] ?? defaultUsername;
        final keyId = importData['keyId'] ?? defaultKeyId;
        final servers = discoveredServers.map((result) => Spi(
          name: result.ip,
          ip: result.ip,
          port: result.port,
          user: username,
          keyId: keyId,
          pwd: _passwordController.text.isEmpty ? null : _passwordController.text,
        )).toList();

        await _batchImportServers(servers);
      }
```
</issue_to_address>